Privacy Notice

Empaco Healthcare Technologies SRL Registered office: Piata Unirii, nr 3, et 2

1. Categories of Personal Data

We may collect and process the following personal data:

- contact details: email address and telephone number (for demo requests and marketing communications); - promotional campaign data: name, contact details (including postal address where relevant for prize delivery); - online identifiers related to advertising campaigns (e.g. cookies, IP address, campaign source), subject to consent.

2. Purposes of Processing and Legal Basis

Your personal data are processed for the following purposes, on the corresponding legal bases:

- to respond to demo requests and communicate with you: necessary for taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); - to send marketing and promotional communications: based on your consent (Art. 6(1)(a) GDPR); - to administer giveaways and promotional campaigns, including winner selection and prize delivery: necessary for performance of a contract (Art. 6(1)(b) GDPR); - to measure the effectiveness of advertisements and campaigns: based on your consent (Art. 6(1)(a) GDPR).

3. Data Retention

Personal data are kept only as long as necessary for the purposes for which they were collected:

- demo requests: until the request and any related follow-up are concluded; - marketing communications: until consent is withdrawn; - giveaways and promotional campaigns: for the duration of the campaign, prize delivery, and a reasonable period thereafter as required by law; - advertising and tracking data: until consent is withdrawn or the data subject opts out.

4. Recipients of Data

Personal data are processed by Empaco and, where applicable, by service providers acting on our behalf. Specifically:

- email addresses are captured and stored by a third-party provider with servers in the United States; - courier or postal services may receive limited personal data (such as name and address) when required for prize delivery. - Data are not shared with additional third parties unless required by law.

5. International Data Transfers

Where personal data are transferred to the United States, such transfers are made in compliance with Chapter V GDPR. They are based either on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on Standard Contractual Clauses together with supplementary measures where necessary.

6. Rights of the Data Subject

Pursuant to Articles 15–22 GDPR, you have the right to:

- access your personal data; - request rectification or erasure; - request restriction of processing; - object to processing, where applicable; - withdraw consent at any time, without affecting the lawfulness of prior processing; - lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (https://www.dataprotection.ro) or with another competent supervisory authority in the EU.

7. Exercise of Rights

You can exercise your rights by contacting Empaco at: contact@empaco.eu. Requests will be handled in accordance with the GDPR.